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Government  Access  to  Phone  Calling  Activity  and 
Related  Records:  Legal  Authorities 


Summary 

Recent  media  disclosures  regarding  an  alleged  National  Security  Agency  (NS  A) 
program  designed  to  collect  and  analyze  information  on  telephone  calling  patterns 
within  the  United  States  have  raised  interest  in  the  means  by  which  the  Government 
may  collect  such  information.  The  factual  information  available  in  the  public  domain 
with  respect  to  any  such  alleged  program  is  limited  and  in  some  instances 
inconsistent,  and  the  application,  if  at  all,  of  any  possibly  relevant  statutory 
provisions  to  any  such  program  is  likely  to  be  a  very  fact  specific  inquiry.  It  is 
possible  that  any  information  provided  to  the  NSA  from  the  telephone  service 
providers  was  provided  in  response  to  a  request  for  information,  not  founded  on  a 
statutory  basis.  If  this  were  the  case,  such  a  request  would  not  necessarily  be  limited 
by  the  statutory  structures  discussed  below,  but  in  some  instances,  depending  upon 
the  facts  involved,  might  expose  the  telephone  companies  to  some  civil  remedies  or 
criminal  sanctions.  In  addition,  a  request,  not  founded  upon  a  statutory  scheme, 
would  appear  to  lack  a  means  of  compelling  production  of  the  information  requested. 
This  would  seem  to  be  consistent  with  the  statement  in  the  USA  Today  article  that 
one  of  the  companies  refused  to  comply  with  NSA’s  request  for  calling  detail 
records,  while  at  least  one  other  company  appears  to  have  complied. 

This  report  will  summarize  statutory  authorities  regarding  access  by  the 
Government,  for  either  foreign  intelligence  or  law  enforcement  purposes,  to 
information  related  to  telephone  calling  patterns  or  practices.  Where  pertinent,  we 
will  also  discuss  statutory  prohibitions  against  accessing  or  disclosing  such 
information,  along  with  relevant  exceptions  to  those  prohibitions. 
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Recent  media  disclosures  regarding  an  alleged  National  Security  Agency  (NS  A) 
program  designed  to  collect  and  analyze  information  on  telephone  calling  patterns 
within  the  United  States  have  raised  interest  in  the  means  by  which  the  Government 
may  collect  such  information.  According  to  the  information  in  the  USA  Today  news 
story  from  May  11,  2006,  the  NS  A  is  alleged  to  have  sought  and  obtained  records  of 
telephone  numbers  called  and  received  from  millions  of  telephones  within  the  United 
States  from  three  telephone  service  providers,  while  a  fourth  had  refused  to  provide 
such  records.  Recent  news  reports  indicate  that  two  of  the  three  service  providers 
originally  reported  to  have  provided  calling  records  have  denied  that  they  provided 
such  records.  The  USA  Today  article  indicated  that  no  names  or  addresses  were 
obtained  in  connection  with  these  telephone  calls,  nor  were  the  contents  of  these 
telephone  calls  sought  or  obtained.  The  USA  Today  story  also  stated  that  one 
telephone  service  provider  had  refused  to  provide  the  NSA  access  to  such 
information  because  of  concerns  about  the  legality  of  such  disclosures.  The  USA 
Today  story  indicated  that  this  information  was  being  compiled  in  a  database  and 
being  used  for  pattern  analysis.  The  President,  in  his  weekly  radio  address  on  May 
13, 2006,  while  discussing  his  nomination  of  General  Michael  V.  Hayden  to  head  the 
Central  Intelligence  Agency,  has  responded  to  the  news  reports  of  NS  A’ s  alleged  data 
mining  activities: 

This  week,  new  claims  have  been  made  about  other  ways  we  are  tracking  down 
al  Qaeda  to  prevent  attacks  on  America.  It  is  important  for  Americans  to 
understand  that  our  activities  strictly  target  al  Qaeda  and  its  known  affiliates.  Al 
Qaeda  is  our  enemy,  and  we  want  to  know  their  plans.  The  intelligence  activities 
1  have  authorized  are  lawful  and  have  been  briefed  to  appropriate  members  of 
Congress,  both  Republican  and  Democrat.  The  privacy  of  all  Americans  is 
fiercely  protected  in  all  our  activities.  The  government  does  not  listen  to 
domestic  phone  calls  without  court  approval.  We  are  not  trolling  through  the 
personal  lives  of  millions  of  innocent  Americans.  Our  efforts  are  focused  on 
links  to  al  Qaeda  terrorists  and  its  affiliates  who  want  to  harm  the  American 
people. 

Americans  expect  their  government  to  do  everything  in  its  power  under  our  laws 
and  Constitution  to  protect  them  and  their  civil  liberties.  That  is  exactly  what  we 
are  doing.  And  so  far,  we  have  been  successful  in  preventing  another  attack  on 
our  soil.... 


The  factual  information  available  in  the  public  domain  with  respect  to  any  such 
alleged  program  is  limited  and  in  some  instances  inconsistent,  and  the  application, 
if  at  all,  of  any  possibly  relevant  statutory  provisions  to  any  such  program  is  likely 
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to  be  a  very  fact  specific  inquiry.  It  is  possible  that  any  information  provided  to  the 
NS  A  from  the  telephone  service  providers  was  provided  in  response  to  a  request  for 
information,  not  founded  on  a  statutory  basis.  If  this  were  the  case,  such  a  request 
would  not  necessarily  be  limited  by  the  statutory  structures  discussed  below,  but  in 
some  instances,  depending  upon  the  facts  involved,  might  expose  the  telephone 
companies  to  some  civil  remedies  or  criminal  sanctions.  In  addition,  a  request,  not 
founded  upon  a  statutory  scheme,  would  appear  to  lack  a  means  of  compelling 
production  of  the  information  requested.  This  would  seem  to  be  consistent  with  the 
statement  in  the  USA  Today  article  that  one  of  the  companies  refused  to  comply  with 
NSA’s  request  for  calling  detail  records,  while  at  least  one  other  company  appears 
to  have  complied.1 

This  report  will  summarize  statutory  authorities  regarding  access  by  the 
Government,  for  either  foreign  intelligence  or  law  enforcement  purposes,  to 
information  related  to  telephone  calling  patterns  or  practices.  Where  pertinent,  we 
will  also  discuss  statutory  prohibitions  against  accessing  or  disclosing  such 
information,  along  with  relevant  exceptions  to  those  prohibitions. 


Background 

The  Supreme  Court,  in  Smith  v.  Maryland ,  442  U.S.  735  (1979),  in  a  pen 
register  case,  has  held  that  there  is  no  Fourth  Amendment  protected  reasonable 
expectation  of  privacy  in  records  of  telephone  calls  in  the  hands  of  third  party 
providers,  where  contents  of  those  calls  is  not  intercepted.  The  Fourth  Amendment 
to  the  United  States  Constitution  guarantees: 

The  right  of  the  people  to  be  secure  in  their  persons,  houses,  papers,  and  effects, 
against  unreasonable  searches  and  seizures,  shall  not  be  violated,  and  no 
Warrants  shall  issue,  but  upon  probable  cause,  supported  by  Oath  or  affirmation, 
and  particularly  describing  the  place  to  be  searched,  and  the  persons  or  things  to 
be  seized.2 

Whether  the  use  of  a  pen  register  is  a  “search  and  seizure”  within  the  meaning 
of  the  Fourth  Amendment  determines  if  the  government,  in  compliance  with  the 
Constitution,  must  secure  a  warrant  or  court  order  prior  to  its  installation.  In  1979, 
the  United  States  Supreme  Court  decided  this  question  in  Smith  v.  Maryland ,3 
holding  that  the  Fourth  Amendment  does  not  prohibit  the  use  of  pen  registers  without 
a  warrant.  Writing  the  majority  opinion  joined  by  four  other  justices,  Justice  Harry 
Blackmun  drew  a  distinction  between  the  acquisition  of  contents  of  telephone 
communications  using  electronic  listening  devices,  which  the  Court  in  Katz  v. 


1  The  USA  Today  story  from  May  11,  2006,  indicates  that  Verizon,  Bell  South,  and  AT&T 
provided  calling  records  in  response  to  the  NSA’s  inquiry  or  production  demand,  while 
Qwest  did  not.  Some  other  stories  have  indicated  that  neither  Bell  South  nor  Verizon 
complied  with  NSA’s  request  or  demand. 

2  U.S.  Const,  amend.  IV. 

3  442  U.S.  735  (1979). 
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United  States4  had  deemed  to  be  a  “search”  under  the  Fourth  Amendment,  and  the 
capture  of  electronic  impulses  that  identify  the  numbers  dialed  on  a  telephone  using 
a  pen  register  device.  According  to  the  majority  in  Smith,  it  is  a  constitutionally 
significant  difference  that  pen  registers  do  not  record  the  contents  of 
communications,  in  contrast  to  the  listening  devices  employed  in  Katz.5  The  Court 
explained  that  the  Fourth  Amendment  does  not  apply  to  the  use  of  pen  registers 
because  individuals  do  not  have  a  legitimate  expectation  of  privacy  against  invasion 
by  government  action,  concerning  the  numbers  dialed  into  a  telephone  system: 

All  telephone  users  realize  that  they  must  “convey”  phone  numbers  to  the 
telephone  company,  since  it  is  through  telephone  company  switching  equipment 
that  their  calls  are  completed.  All  subscribers  realize,  moreover,  that  the  phone 
company  has  facilities  for  making  permanent  records  of  the  numbers  they  dial, 
for  they  see  a  list  of  their  long-distance  (toll)  calls  on  their  monthly  bills.  In  fact, 
pen  registers  and  similar  devices  are  routinely  used  by  telephone  companies  “for 
the  purposes  of  checking  billing  operations,  detecting  fraud,  and  preventing 
violations  of  law.”6 

The  Court  stated  that  telephone  customers,  by  voluntarily  conveying  phone 
numbers  to  the  telephone  company  and  “expos[ing]  that  information  to  its  equipment 
in  the  ordinary  course  of  business,”  assume  the  risk  that  the  company  may  disclose 
such  information  to  law  enforcement.7  Because  there  is  no  actual  or  legitimate 
expectation  of  privacy  in  the  numbers  dialed  from  a  telephone,  the  installation  and 
use  of  a  pen  register  is  not  a  “search”  requiring  a  warrant  under  the  Fourth 
Amendment,  the  Court  ruled.8 

The  dissenting  opinions  in  Smith  believed  that  telephone  numbers  dialed  from 
a  phone  are  entitled  to  the  same  constitutional  protection  that  telephone  conversations 
receive  under  Katz  because  such  numbers  are  not  without  “content”  -  they  “reveal  the 
identities  of  the  persons  and  the  places  called,  and  thus  reveal  the  most  intimate 
details  of  a  person’s  life.”9  Furthermore,  the  dissenters  objected  to  the  majority’s 
characterization  that  the  use  of  a  telephone  involves  an  assumption  of  risk  on  the  part 
of  the  customer  that  telephone  dialing  information  might  be  disclosed  to  the 
government;  assumption  of  risk  generally  requires  there  to  have  been  a  choice  to 
engage  in  the  activity,  and  “as  a  practical  matter,  individuals  have  no  realistic 
alternative”  to  the  use  of  a  telephone.10 

There  are,  however,  a  number  of  statutes  enacted  since  1979,  which  both  permit 
access  by  the  Government,  for  foreign  intelligence  or  law  enforcement  purposes,  to 


4  389  U.S.  347(1967). 

5  Smith ,  442  U.S.  at  741  (emphasis  in  original). 

6  Id.  at  742  (quoting  United  States  v.  New  York  Tel.  Co.,  434  U.S.  159,  174-75  (1977)). 

7  Id.  at  744. 

8  Id.  at  745-46. 

9  Id.  at  747-48  (Stewart,  J.,  dissenting). 

10  Id.  at  749  (Marshall,  J.,  dissenting). 
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information  relating  to  telephone  numbers  dialed  from  or  received  by  a  particular 
telephone  number,  as  well  as  duration  and  usage,  and  which  impose  limitations  as  to 
how  such  information  may  be  accessed  and  under  what  circumstances  it  may  be  used. 
Some  of  these  statutes  also  provide  criminal  penalties  for  violations  of  their 
provisions  and  provide  civil  remedies  to  those  adversely  impacted  by  such  violations. 
In  addition,  the  Communications  Act  of  1934,  as  amended,  addresses  protections  to 
customer  proprietary  network  information,  and  provides  civil  and  criminal  penalties 
for  violations  of  its  provisions  or  implementing  regulations. 


Statutory  Provisions 


Summary 

Information  regarding  telephone  calling  patterns,  duration,  usage,  and  length  of 
service  may  be  sought  by  the  government  either  directly  through  the  use  of  pen 
registers11  or  trap  and  trace  devices,12  or  indirectly  by  seeking  telephone  toll  or 
transactional  records  from  third  party  providers.  Statutory  provisions  authorizing, 
pursuant  to  court  order,  the  use  of  pen  registers  and  trap  and  trace  devices  exist  in 
both  the  Foreign  Intelligence  Surveillance  Act  (FISA),  50  U.S.C.  §  1841  etseq.,  and, 
for  law  enforcement  purposes,  in  18  U.S.C.  §  3121  et  seq. 

FISA’s  “business  records”  provision,  50  U.S.C.  §  1861,  provides  for  authority, 
pursuant  to  court  order,  for  requests  for  production  of  “any  tangible  thing”  relevant 
to  collection  of  foreign  intelligence  information  not  concerning  a  U.S.  person,  or 
relevant  to  an  investigation  into  international  terrorism  or  clandestine  intelligence 
activities.  Under  50  U.S.C.  §  1861,  an  investigation  concerning  a  U.S.  person  may 
not  be  based  solely  on  First  Amendment  protected  activities. 

Access  to  stored  electronic  communications  is  addressed  in  18  U.S.C.  §  2701 
etseq.  1 8  U.S.C.  §  2702  prohibits  voluntary  disclosure  of  customer  communications 


11  Under  50  U.S.C.  §  1841(2),  which  cross  references  the  definition  in  18  U.S.C.  §  3127(3), 
the  term  “pen  register”  “means  a  device  or  process  which  records  or  decodes  dialing, 
routing,  addressing,  or  signaling  information  transmitted  by  an  instrument  or  facility  from 
which  a  wire  or  electronic  communication  is  transmitted,  provided,  however,  that  such 
information  shall  not  include  the  contents  of  any  communication,  but  such  term  does  not 
include  any  device  or  process  used  by  a  provider  or  customer  of  a  wire  or  electronic 
communication  service  for  billing,  or  recording  as  an  incident  to  billing,  for  communications 
services  provided  by  such  provider  or  any  device  or  process  used  by  a  provider  or  customer 
of  a  wire  communication  service  for  cost  accounting  or  other  like  puiposes  in  the  ordinary 
course  of  its  business.” 

12  Under  50  U.S.C.  §  1841(2),  which  cross  references  the  definition  in  18  U.S.C.  §  3127(4), 
the  term  “trap  and  trace  device”  “means  a  device  or  process  which  captures  the  incoming 
electronic  or  other  impulses  which  identify  the  originating  number  or  other  dialing,  routing, 
addressing,  and  signaling  information  reasonably  likely  to  identify  the  source  of  a  wire  or 
electronic  communication,  provided,  however,  that  such  information  shall  not  include  the 
contents  of  any  communication.” 
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records  by  a  service  provider  unless  it  falls  within  one  of  several  exceptions. 
Required  disclosure  of  customer  records  to  the  government  under  certain 
circumstances  is  addressed  under  18  U.S.C.  §  2703,  including,  among  others, 
disclosure  pursuant  to  a  warrant  or  grand  jury  or  trial  subpoena.  18  U.S.C.  §  2709 
is  a  national  security  letter  provision,  under  which  a  wire  or  electronic  service 
provider13  must  provide  subscriber  information  and  toll  billing  records  information, 
or  electronic  communication  transactional  records  in  its  custody  or  possession  in 
response  to  a  request  by  the  Director  of  the  Federal  Bureau  of  Investigation  (FBI)  if 
the  Director  of  the  FBI,  or  his  designee  in  a  position  not  lower  than  Deputy  Assistant 
Director  at  Bureau  headquarters  or  a  Special  Agent  in  Charge  designated  by  the  FBI 
Director  in  a  field  office,  certifies  that  the  records  or  information  sought  is  relevant 
to  an  authorized  investigation  to  protect  against  international  terrorism  or  clandestine 
intelligence  activities,  provided  that  such  an  investigation  of  a  U.S.  person  is  not 
conducted  solely  on  the  basis  of  First  Amendment  protected  activities.  In  addition, 
Section  222  of  the  Communications  Act  of  1934,  as  amended,  47  U.S.C.  §  222, 
provides  protections  to  customer  proprietary  network  information,  and  violations  of 
pertinent  provisions  of  law  or  regulation  may  expose  service  providers  to  criminal 
provisions,  civil  penalties  and  forfeiture  provisions,  47  U.S.C.  §§  501-503.  There 
follows  a  more  detailed  description  of  these  provisions. 

50  U.S.C.  §  1842  —  Pen  Registers  and  Trap  and  Trace 
Devices  for  Foreign  Intelligence  and  International  Terrorism 
Investigations  Under  FISA 

Under  this  provision,14  the  Attorney  General  or  a  designated  attorney  for  the 
Government  may  apply  for  an  ex  parte  court  order  authorizing  the  use  of  a  pen 
register  or  trap  and  trace  device  to  a  Foreign  Intelligence  Surveillance  Court  (FISC) 
judge  or  to  a  U.S.  magistrate  judge  designated  by  the  Chief  Justice  of  the  United 
States  to  have  the  power  to  hear  applications  or  grant  orders  approving  installation 
and  use  of  a  pen  register  or  trap  and  trace  device  on  behalf  of  an  FISC  judge.  The 
application  must  be  approved  by  the  Attorney  General  or  a  designated  Government 
attorney;  must  identify  the  Federal  officer  seeking  to  use  the  pen  register  or  trap  and 
trace  device;  and  must  include  a  certification  that  the  information  likely  to  be 
obtained  is  foreign  intelligence  information15  not  concerning  a  U.S.  person16  or  that 


13  Under  18  U.S.C.  §  2709(f),  “A  library  (as  that  term  is  defined  in  section  213(1)  of  the 
Library  Services  and  Technology  Act  (20  U.S.C.  9122(1)),  the  services  of  which  include 
access  to  the  Internet,  books,  journals,  magazines,  newspapers,  or  other  similar  forms  of 
communication  in  print  or  digitally  by  patrons  for  their  use,  review,  examination,  or 
circulation,  is  not  a  wire  or  electronic  communication  service  provider  for  purposes  of  this 
section,  unless  the  library  is  providing  the  services  defined  in  section  25 10(15)  (“electronic 
communication  service”)  of  this  title.”  Subsection  (f)  was  added  by  P.L.  109-178,  §  5. 

14  Other  provisions  of  this  chapter  deal  with  authorization  for  pen  registers  or  trap  and  trace 
devices  during  emergencies,  50  U.S.C.  §  1843,  authorization  during  time  of  war,  50  U.S.C. 
1844,  use  of  information  gathered  under  a  FISA  pen  register  or  trap  and  trace  device,  50 
U.S.C.  §  1845,  and  congressional  oversight,  50  U.S.C.  §  1846. 

15  Under  18  U.S.C.  §  1801(e),  “foreign  intelligence  information”  is  defined  to  mean 
information  that  relates  to,  and  if  concerning  a  United  States  person  is  necessary  to,  the 

(continued...) 
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the  information  is  relevant  to  an  ongoing  investigation  to  protect  against  international 
terrorism  or  clandestine  intelligence  activities.  An  investigation  of  a  U.S .  person  may 
not  be  conducted  solely  on  the  basis  of  First  Amendment  protected  activities. 

The  order  must  specify  the  identity  of  the  person  who  is  the  subject  of  the 
investigation,  if  known.  If  known,  the  order  must  identify  the  person  to  whom  the 
telephone  line  or  other  facility  to  which  the  pen  register  or  trap  and  trace  device  is  to 
be  attached  is  leased  or  in  whose  name  it  is  listed.  In  addition,  the  order  must  list  the 
attributes  of  the  communications  to  which  it  applies,  such  as  the  number  or  other 
identifier  and,  if  known,  the  location  of  the  telephone  line  or  other  facility  involved. 
In  the  case  of  a  trap  and  trace  device,  the  order  must  also  identify  the  geographic 
limits  of  the  trap  and  trace  order. 

Such  an  order,  at  the  request  of  the  applicant,  also  directs  the  provider  of  the 
wire  or  electronic  service,  landlord,  custodian,  or  other  person,  to  furnish  any 
information,  facilities,  or  technical  assistance  needed  to  accomplish  the  installation 
and  operation  of  the  pen  register  or  trap  and  trace  device  in  a  manner  that  will  protect 
its  secrecy  and  minimize  interference  with  the  services  provided.  In  addition,  the 
order  directs  the  provider,  landlord,  custodian,  or  other  person  not  to  disclose  the 
existence  of  the  investigation  or  the  pen  register  or  trap  and  trace  device  to  anyone 
unless  or  until  ordered  to  do  so  by  the  court.  Records  concerning  the  pen  register  or 
trap  and  trace  device  or  the  aid  furnished  are  to  be  kept  under  security  procedures 
approved  by  the  Attorney  General  and  the  Director  of  National  Security  under  50 
U.S.C.  §  1805(b)(2)(C). 

The  order  also  directs  the  applicant  for  the  order  to  provide  compensation  for 
reasonable  expenses  incurred  by  the  provider,  landlord,  custodian  or  other  person  in 
providing  information,  facilities,  or  technical  assistance. 

Upon  the  request  of  the  applicant  for  the  court  order,  the  court  shall  direct  the 
wire  or  electronic  service  provider  to  provide  the  federal  officer  using  the  pen  register 
or  trap  and  trace  device  with  the  name;  address;  and  the  telephone  number, 
instrument  number  or  subscriber  number  or  identifier  of  the  customer  or  subscriber 
using  the  service  covered  by  the  order  for  the  period  specified  by  the  order,  including 


15  (...continued) 

ability  of  the  United  States  to  protect  against  actual  or  potential  attack  or  other  grave  hostile 
acts  of  a  foreign  power  or  an  agent  of  a  foreign  power,  sabotage  or  international  terrorism 
by  a  foreign  power  or  an  agent  of  a  foreign  power,  or  clandestine  intelligence  activities  by 
an  intelligence  service  or  network  of  a  foreign  power  or  by  an  agent  of  a  foreign  power;  or 
information  with  respect  to  a  foreign  power  or  foreign  territory  that  relates  to,  and  if 
concerning  a  United  States  person  is  necessary  to  the  national  defense  or  the  security  of  the 
United  States  or  the  conduct  of  the  foreign  affairs  of  the  United  States. 

16  Under  50  U.S.C.  §  1 80 1  (i),  “United  States  person”  means  a  citizen  of  the  United  States, 
an  alien  lawfully  admitted  for  permanent  residence  (as  defined  in  section  1 101  (a)(20)  of 
Title  8),  an  unincorporated  association  a  substantial  number  of  members  of  which  are 
citizens  of  the  United  States  or  aliens  lawfully  admitted  for  permanent  residence,  or  a 
corporation  which  is  incorporated  in  the  United  States,  but  does  not  include  a  corporation 
or  an  association  which  is  a  foreign  power,  as  defined  in  subsection  (a)(1),  (2),  or  (3)  of  this 
section. 
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temporarily  assigned  network  address  or  associated  routing  or  transmission 
information.  The  service  provider  must  also  provide,  if  so  ordered  by  the  court  upon 
the  applicant’s  request,  information  on  length  of  service  of  the  customer  or 
subscriber,  as  well  as  local  or  long  distance  telephone  records  of  the  subscriber  or 
customer,  and,  if  applicable,  any  records  on  periods  of  usage  by  the  customer  or 
subscriber.  Further,  the  court,  at  the  applicant’ s  request,  may  order  disclosure  by  the 
service  provider  of  any  mechanisms  and  sources  of  payment  for  the  service  (i.e., 
credit  card,  bank  account). 

If  the  information  is  available  with  respect  to  any  customer  or  subscriber  of 
incoming  or  outgoing  communications  to  or  from  the  service  covered  by  the  order, 
the  court,  upon  the  request  of  the  applicant  for  the  order,  is  to  direct  the  wire  or 
electronic  service  provider  to  provide  the  name;  address;  telephone  number, 
instrument  number  or  other  subscriber  number  or  identifier,  of  such  customer  or 
subscriber,  as  well  as  length  of  service  provided  to  and  types  of  serviced  utilized  by 
the  subscriber  or  customer. 

In  general,  the  duration  of  an  order  issued  under  this  section  is  not  to  exceed  90 
days,  with  the  possibility  of  extension  for  periods  of  not  more  than  90  days. 
However,  if  the  applicant  for  the  order  certifies  that  the  information  likely  to  be 
obtained  is  foreign  intelligence  information  not  concerning  a  United  States  person, 
then  an  extension  may  be  for  up  to  a  year.  No  cause  of  action  may  be  brought  against 
any  wire  or  electronic  service  provider,  landlord,  custodian,  or  other  person  that 
furnishes  information,  facilities,  or  technical  assistance  pursuant  to  an  order  issued 
under  this  provision.  Unless  otherwise  ordered  by  the  judge,  the  results  of  the  pen 
register  or  trap  and  trace  device  are  to  be  provided  to  the  authorized  Government 
official  or  officials  at  reasonable  intervals. 

18  U.S.C.  §  3121-3123  —  Pen  Registers  or  Trap  and  Trace 
Devices  Generally,  and  for  Use  in  an  Ongoing  Criminal 
Investigation 

18  U.S.C.  §  3121  prohibits  the  installation  and  use  of  a  pen  register  or  trap  and 
trace  device  without  first  obtaining  a  court  order  under  FISA  or  under  18  U.S.C.  § 
3123.  This  prohibition  does  not  apply  to  use  by  an  electronic  or  wire  service  provider 
relating  to  the  operation,  maintenance  and  testing  of  a  service  or  protection  of  the 
rights  or  property  of  the  service  provider;  the  protection  of  users  of  the  service  from 
abuse  or  unlawful  use  of  the  service;  to  recording  of  the  fact  that  a  wire  or  electronic 
communication  was  initiated  or  completed  to  protect  the  service  provider,  another 
provider  furnishing  service  toward  completion  of  the  wire  communication,  or  a  user 
of  the  service  from  fraudulent,  unlawful  or  abusive  use  of  the  service;  or  to  use  where 
the  consent  of  the  user  of  the  service  has  been  obtained.  A  government  agency 
authorized  to  install  and  use  a  pen  register  or  trap  and  trace  device  under  the 
provisions  of  this  chapter  of  Title  18,  U.S.C.,  or  under  state  law  must  use  technology 
reasonably  available  to  it  that  restricts  the  recording  or  decoding  of  electronic  or 
other  impulses  to  the  dialing,  routing,  addressing,  and  signaling  information  utilized 
in  the  processing  and  transmitting  of  wire  or  electronic  communications  in  a  manner 
that  does  not  include  the  contents  of  that  communication. 
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An  application  for  a  court  order  authorizing  a  pen  register  or  trap  and  trace 
device  under  this  chapter  must  be  made  pursuant  to  18  U.S.C.  §  3122  in  writing 
under  oath  or  affirmation  to  a  court  of  competent  jurisdiction.  Such  an  application 
must  include  the  identity  of  the  attorney  for  the  Government  or  the  state  law 
enforcement  or  investigative  officer  making  the  application  and  the  identity  of  the 
law  enforcement  agency  conducting  the  investigation,  as  well  as  a  certification  by  the 
applicant  that  the  information  likely  to  be  obtained  is  relevant  to  an  ongoing  criminal 
investigation  being  conducted  by  that  agency.  Under  18  U.S.C.  §  3123,  the  court 
shall  enter  an  ex  parte  order  authorization  installation  and  use  of  a  pen  register  or  trap 
and  trace  device  anywhere  in  the  United  States  if  the  court  finds  that  the  applicant  for 
the  order  has  made  such  a  certification.  An  order  may  authorize  installation  and  use 
of  a  pen  register  or  trap  and  trace  device  for  a  period  of  up  to  60  days,  which  can  be 
extended  by  court  order  for  additional  periods  of  no  more  than  60  days.  The  order 
must  also  direct  that  the  order  be  sealed  until  otherwise  ordered  by  the  court,  and 
must  prohibit  the  person  owning  or  leasing  the  line  or  other  facility  to  which  the  pen 
register  or  trap  and  trace  device  is  attached  or  applied,  or  who  is  obligated  by  the 
order  to  assist  the  applicant,  from  disclosing  the  existence  of  the  pen  register  or  trap 
and  trace  device  or  of  the  investigation  to  the  listed  subscriber  or  to  any  other  person 
unless  or  until  the  court  orders  otherwise.17 

50  U.S.C.  §  1861  —  Access  to  Business  Records  for  Foreign 
Intelligence  and  International  Terrorism  Investigations 

Under  50  U.S.C.  §  1861,  the  Director  of  the  Federal  Bureau  of  Investigation 
(FBI)  or  a  designee  of  the  Director,  whose  rank  shall  not  be  lower  than  Assistant 
Special  Agent  in  Charge,  may  apply  to  the  FISA  court  for  an  order  granting  the 
government  access  to  any  tangible  item  (including  books,  records,  papers, 
documents,  and  other  items)  for  an  investigation  to  obtain  foreign  intelligence 
information  not  concerning  a  United  States  person,  or  to  protect  against  international 
terrorism  or  clandestine  intelligence  activities.  Such  an  investigation  of  a  United 
States  person  may  not  be  conducted  solely  upon  the  basis  of  activities  protected  by 
the  first  amendment  to  the  Constitution. 

The  application  for  such  an  order  must  include  a  statement  of  facts 
demonstrating  that  there  are  reasonable  grounds  to  believe  that  the  tangible  things 
sought  are  relevant  to  an  authorized  or  preliminary  investigation  to  protect  against 
international  terrorism  or  espionage,  or  to  obtain  foreign  intelligence  information  not 
concerning  a  U.S.  person.18  However,  certain  tangible  items  are  deemed 
presumptively  relevant  to  an  investigation  if  the  application’s  statement  of  facts 
shows  that  the  items  sought  pertain  to  a  foreign  power  or  an  agent  of  a  foreign  power, 
the  activities  of  a  suspected  agent  of  a  foreign  power  who  is  the  subject  of  such 


17  18  U.S.C.  §  3124  addresses  assistance  in  installation  and  use  of  the  pen  register  or  trap 
and  trace  device;  while  18  U.S.C.  §  3125  deals  with  emergency  installation  of  a  pen  register 
and  trap  or  trap  and  trace  device.  18  U.S.C.  §  2136  provides  for  annual  reports  to  Congress 
by  the  Attorney  General  on  the  number  of  applications  by  law  enforcement  agencies  of  the 
Department  of  Justice  for  pen  registers  or  trap  and  trace  devices  orders,  as  well  as  certain 
details  with  respect  to  court  orders  issued  in  response  to  such  applications. 

18  50  U.S.C.  §  1861(b)(2)(A). 
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authorized  investigation,  or  an  individual  in  contact  with,  or  known  to,  a  suspected 
agent  of  a  foreign  power  who  is  the  subject  of  such  authorized  investigation. 

The  FISA  court  judge  shall  approve  an  application  for  an  order  under  50  U.S.C. 
§  1861,  as  requested  or  as  modified,  upon  a  finding  that  the  application  complies 
with  statutory  requirements.  The  order  must  contain  a  particularized  description  of 
the  items  sought,  provide  for  a  reasonable  time  to  assemble  them,  and  be  limited  to 
things  which  may  be  obtained  under  a  grand  jury  subpoena  or  an  order  of  a  U.S.  court 
for  production  of  records  or  tangible  things.19  The  order  to  produce  the  tangible 
things  (production  order)  is  also  accompanied  by  a  nondisclosure  requirement 
(nondisclosure  order)  that  prohibits  the  recipient  from  disclosing  to  any  other  person 
that  the  FBI  has  sought  the  tangible  things  described  in  the  order,  with  limited 
exceptions.20  The  recipient  may  immediately  challenge  the  legality  of  the  production 
order  by  filing  a  petition  with  the  FISA  court;  however,  the  recipient  must  wait  one 
year  before  challenging  the  nondisclosure  order.21  A  FISA  court  judge  considering 
the  recipient’s  petition  to  modify  or  set  aside  the  production  order  may  do  so  only  if 
the  judge  finds  that  the  order  does  not  meet  statutory  requirements  or  is  otherwise 
unlawful.22  A  nondisclosure  order  may  be  modified  or  set  aside  if  the  judge  finds 
that  there  is  no  reason  to  believe  that  disclosure  may  endanger  the  national  security 
of  the  United  States;  interfere  with  a  criminal,  counterterrorism,  or 
counterintelligence  investigation;  interfere  with  diplomatic  relations;  or  endanger  the 
life  or  physical  safety  of  any  person.23  If,  at  the  time  the  individual  files  the  petition 
for  judicial  review  of  a  nondisclosure  order,  the  Attorney  General,  Deputy  Attorney 
General,  an  Assistant  Attorney  General,  or  the  Director  of  the  FBI  certifies  that 
disclosure  may  endanger  the  national  security  of  the  United  States  or  interfere  with 
diplomatic  relations,  then  the  FISA  judge  must  treat  such  government  certification 
as  conclusive  unless  the  judge  finds  that  the  certification  was  made  in  bad  faith.24 

18  U.S.C.  §  2701  et  seq.  —  Access  to  Stored  Electronic 
Communications  and  Transactional  Records 

Access  to  stored  electronic  communications  and  transactional  records  is 
addressed  in  18  U.S.C.  §  2701  et  seq.  Under  18  U.S.C.  §  2702,  voluntary  disclosure 
of  customer  communications  records  by  a  service  provider  is  prohibited  unless  it  falls 
within  one  of  several  exceptions,  including,  among  others,  disclosure  as  authorized 
in  18  U.S.C.  §  2703;  disclosure  with  the  lawful  consent  of  the  customer  or 
subscriber;  or  disclosure  to  a  governmental  entity,  if  the  provider,  in  good  faith, 


19  50  U.S.C.  §  1861(c). 

20  A  recipient  of  a  FISA  order  under  this  section  may  disclose  its  existence  to  persons  to 
whom  disclosure  is  necessary  to  comply  with  the  order,  to  an  attorney  to  obtain  legal  advice 
with  respect  to  the  production  of  things  in  response  to  the  order,  as  well  as  to  other  persons 
approved  by  the  FBI.  50  U.S.C.  §  1861(d)(1). 

21  50  U.S.C.  §  1861(f)(2)(A). 

22  50  U.S.C.  §  1861(f)(2)(B). 

23  50  U.S.C.  §  1861(f)(2)(C)(i). 

24  50  U.S.C.  §  1861  (f)(2)(C)(ii). 
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believes  that  an  emergency  involving  danger  of  death  or  serious  physical  injury  to 
any  person  requires  disclosure  without  delay  of  information  relating  to  the 
emergency.25  Under  18  U.S.C.  §  2703,  a  provider  of  electronic  communication 
service  or  remote  computing  service  shall  disclose  to  a  government  entity  the  name, 
address,  local  and  long  distance  telephone  connection  records,  or  records  of  session 
times  and  durations,  length  of  service  and  types  of  service  utilized,  telephone 
instrument  number  or  other  subscriber  number  or  identity,  including  temporarily 
assigned  network  address,  and  means  and  source  of  payment  for  such  service 
pursuant  to:  a  warrant;  a  court  order  based  upon  specific  and  articulable  facts 
showing  that  there  are  reasonable  grounds  to  believe  that  the  contents  of  a  wire  or 
electronic  communication  or  the  records  or  other  information  sought  are  relevant  and 
material  to  an  ongoing  criminal  investigation;  customer  or  subscriber  consent;  or  a 
written  request  from  the  governmental  entity  relevant  to  a  law  enforcement 
investigation  regarding  telemarketing  fraud;  or  pursuant  to  an  administrative 
subpoena  authorized  by  federal  or  state  statute,  or  a  federal  or  state  grand  jury 
subpoena  or  trial  subpoena.  A  governmental  entity  receiving  such  records  or 
information  is  not  required  to  provide  notice  to  a  subscriber  or  customer.  Nor  does 
any  cause  of  action  lie  against  any  service  provider  of  wire  or  electronic 
communication  service,  its  officers,  employees,  agents,  or  other  specified  persons  for 
providing  information,  facilities,  or  assistance  in  accordance  with  the  terms  of  a  court 
order,  warrant,  subpoena,  statutory  authorization  or  certification  under  this  chapter. 

18  U.S.C.  §  2706  requires  a  government  entity  obtaining  records  or  other 
information  under  §§  2702  or  2703  to  reimburse  the  costs  reasonably  necessary  and 
directly  incurred  in  searching  for,  assembling,  reproducing  or  otherwise  providing 
such  information.  The  amount  of  payment  is  to  be  mutually  agreed  upon  by  the 
government  entity  and  the  person  or  entity  providing  the  information,  or,  in  the 
absence  of  an  agreement,  determined  by  the  court  issuing  the  production  order.  The 
reimbursement  requirement  does  not  apply  to  records  or  other  information 
maintained  by  a  communications  common  carrier  that  relate  to  telephone  records  and 
telephone  listings  obtained  under  18  U.S.C.  §  2703  unless  a  court  orders  payment 
upon  a  determination  that  the  information  required  is  unusually  voluminous  in  nature 
or  otherwise  caused  an  undue  burden  upon  the  provider. 

Under  18  U.S.C.  §  2709,  a  national  security  letter  provision,  wire  or  electronic 
service  providers26  must  provide  subscriber  information  and  toll  billing  records 
information,  or  electronic  communication  transactional  records  in  its  custody  or 


25  This  language  was  added  by  P.L.  109-177,  Title  I,  §  107(b)(1)(B).  It  replaced  an 
exception  which  covered  “disclosure  to  a  governmental  entity  if  the  provider  reasonably 
believes  that  an  emergency  involving  immediate  danger  of  death  or  serious  physical  injury 
to  any  person  j  ustifies  disclosure  of  the  information.” 

26  Under  18  U.S.C.  §  2709(f),  “A  library  (as  that  term  is  defined  in  section  213(1)  of  the 
Library  Services  and  Technology  Act  (20  U.S.C.  9122(1)),  the  services  of  which  include 
access  to  the  Internet,  books,  journals,  magazines,  newspapers,  or  other  similar  forms  of 
communication  in  print  or  digitally  by  patrons  for  their  use,  review,  examination,  or 
circulation,  is  not  a  wire  or  electronic  communication  service  provider  for  purposes  of  this 
section,  unless  the  library  is  providing  the  services  defined  in  section  25 10(15)  (“electronic 
communication  service”)  of  this  title.”  Subsection  (f)  was  added  by  P.L.  109-178,  §  5. 
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possession  in  response  to  a  request  by  the  Director  of  the  Federal  Bureau  of 
Investigation  (FBI)  if  the  Director  of  the  FBI,  or  his  designee  in  a  position  not  lower 
than  Deputy  Assistant  Director  at  Bureau  headquarters  or  a  Special  Agent  in  Charge 
designated  by  the  FBI  Director  in  a  field  office,  certifies  that  the  records  or 
information  sought  is  relevant  to  an  authorized  investigation  to  protect  against 
international  terrorism  or  clandestine  intelligence  activities,  provided  that  such  an 
investigation  of  a  U.S.  person  is  not  conducted  solely  on  the  basis  of  First 
Amendment  protected  activities.  Under  18  U.S.C.  §  2709(b),  if  the  Director  of  the 
Federal  Bureau  of  Investigation,  or  his  designee,  certifies  that  otherwise  there  may 
result  a  danger  to  the  national  security  of  the  United  States,  interference  with  a 
criminal,  counterterrorism,  or  counterintelligence  investigation,  interference  with 
diplomatic  relations,  or  danger  to  the  life  or  physical  safety  of  any  person,  no  wire  or 
electronic  communications  service  provider,  or  officer,  employee,  or  agent  thereof, 
shall  disclose  to  any  person  (other  than  those  to  whom  such  disclosure  is  necessary 
to  comply  with  the  request  or  an  attorney  to  obtain  legal  advice  or  legal  assistance 
with  respect  to  the  request)  that  the  Federal  Bureau  of  Investigation  has  sought  or 
obtained  access  to  information  or  records  under  this  section.27  The  FBI  must  notify 
the  person  or  entity  to  whom  a  §2709(b)  request  is  made  where  such  a  nondisclosure 
requirement  is  applicable.  A  recipient  of  such  a  request  who  notifies  those  to  whom 
notice  is  necessary  for  compliance  with  the  request  or  who  notifies  an  attorney  to 
obtain  legal  advice  or  legal  assistance  with  respect  to  the  request  must  also  advise 
them  of  the  nondisclosure  requirement.  At  the  request  of  the  Director  of  the  Federal 
Bureau  of  Investigation  or  the  designee  of  the  Director,  any  person  making  or 
intending  to  make  a  disclosure  under  this  section  shall  identify  to  the  Director  or  such 
designee  the  person  to  whom  such  disclosure  will  be  made  or  to  whom  such 
disclosure  was  made  prior  to  the  request,  except  that  nothing  in  this  section  shall 
require  a  person  to  inform  the  Director  or  such  designee  of  the  identity  of  an  attorney 
to  whom  disclosure  was  made  or  will  be  made  to  obtain  legal  advice  or  legal 
assistance  with  respect  to  the  request.  The  FBI  may  only  disseminate  records 
obtained  under  this  section  as  provided  in  guidelines  approved  by  the  Attorney 
General  for  foreign  intelligence  collection  and  foreign  counterintelligence 
investigations  conducted  by  the  Federal  Bureau  of  Investigation,  and,  with  respect  to 
dissemination  to  an  agency  of  the  United  States,  only  if  such  information  is  clearly 
relevant  to  the  authorized  responsibilities  of  such  agency.  On  a  semiannual  basis,  the 
Director  of  the  Federal  Bureau  of  Investigation  is  required  to  fully  inform  the 
Permanent  Select  Committee  on  Intelligence  of  the  House  of  Representatives  and  the 
Select  Committee  on  Intelligence  of  the  Senate,  and  the  Committee  on  the  Judiciary 


27  P.L.  109-177,  §  1 16(a),  rewrote  subsection  (c)  of  18  U.S.C.  §  2709,  which  formerly  read, 
“No  wire  or  electronic  communication  service  provider,  or  officer,  employee,  or  agent 
thereof,  shall  disclose  to  any  person  that  the  Federal  Bureau  of  Investigation  has  sought  or 
obtained  access  to  information  or  records  under  this  section.”  P.L.  109-178,  §  4(b),  rewrote 
subsection  (c)(4),  as  amended  by  P.L.  109-177,  §  116(a),  which  formerly  read,  “At  the 
request  of  the  Director  of  the  Federal  Bureau  of  Investigation  or  the  designee  of  the 
Director,  any  person  making  or  intending  to  make  a  disclosure  under  this  section  shall 
identify  to  the  Director  or  such  designee  the  person  to  whom  such  disclosure  will  be  made 
or  to  whom  such  disclosure  was  made  prior  to  the  request,  but  in  no  circumstance  shall  a 
person  be  required  to  inform  the  Director  or  such  designee  that  the  person  intends  to  consult 
an  attorney  to  obtain  legal  advice  or  legal  assistance.” 
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of  the  House  of  Representatives  and  the  Committee  on  the  Judiciary  of  the  Senate, 
concerning  all  requests  made  under  subsection  (b)  of  this  section. 

Except  as  provided  in  18  U.S.C.  §  2703(e),  18  U.S.C.  §  2707  provides  a  civil 
cause  of  action  for  any  provider  of  electronic  communication  service,  subscriber,  or 
other  person  aggrieved  by  a  knowing  or  intentional  violation  of  this  chapter.  The 
aggrieved  party  may  receive  equitable  relief  and  damages.  The  damages  which  may 
be  assessed  by  the  court  are  actual  damages  suffered  by  the  plaintiff  plus  any  profits 
made  by  the  violator  as  a  result  of  the  violation.  At  a  minimum,  a  person  entitled  to 
recover  damages  must  receive  no  less  than  $1,000.  If  a  court  or  appropriate 
department  or  agency  determines  that  the  United  States  has  violated  this  chapter  and 
that  the  circumstances  surrounding  the  violation  raise  questions  as  to  whether  a 
federal  officer  or  employee  acted  willfully  or  intentionally  with  respect  to  the 
violation,  disciplinary  action  against  that  officer  or  employee  may  also  be  initiated. 

A  person  aggrieved  by  a  willful  violation  of  this  chapter  or  a  willful  violation 
of  50  U.S.C.  §  1845(a),  which  deals  use  of  information  gathered  through  a  pen 
register  and  trap  and  trace  under  FISA,  may  commence  a  civil  action  against  the 
United  States  in  a  U.S.  district  court  to  receive  money  damages  under  18  U.S.C.  § 
2712.  If  the  claim  is  successful  in  establishing  such  a  violation,  the  court  may  assess 
actual  damages,  but  not  less  than  $10,000,  whichever  is  greater,  plus  reasonably 
incurred  litigation  costs.  There  is  a  two  year  statute  of  limitations  applicable  to  this 
provision,  and  this  section  states  that  this  is  the  exclusive  remedy  against  the  United 
States  for  claims  within  the  purview  of  the  section.  The  agency  or  department  must 
reimburse  any  award  under  this  section  to  the  U.S.  treasury.  Administrative 
discipline  may  also  be  pursued.  A  proceeding  under  18  U.S.C.  §  2712  shall  be 
stayed  by  the  court,  upon  motion  by  the  United  States,  if  the  court  determines  that 
civil  discovery  will  adversely  affect  the  Government’s  ability  to  conduct  a  related 
investigation  or  prosecution  of  a  related  criminal  case.  Such  a  stay  would  toll  the 
statute  of  limitations. 

47  U.S.C.  §§  222,  501-503  —  Communications  Act  of  1934 

Telecommunications  carriers  are  subject  to  obligations  to  guard  the 
confidentiality  of  customer  proprietary  network  information  (CPNI)  and  to  ensure 
that  it  is  not  disclosed  to  third  parties  without  customer  approval  or  as  required  by 
law.  Section  222  of  the  Communication  Act  of  1934,  as  amended,  establishes  a  duty 
of  every  telecommunications  carrier  to  protect  the  confidentiality  of  its  customers’ 
customer  proprietary  network  information.28  Section  222  attempts  to  achieve  a 
balance  between  marketing  and  customer  privacy. 

CPNI  includes  personally  identifiable  information  derived  from  a  customer’s 
relationship  with  a  telephone  company,  irrespective  of  whether  the  customer 
purchases  landline  or  wireless  telephone  service.  CPNI  is  defined  as 


28  47  U.S.C.  §  222.  Section  222  was  added  to  the  Communications  Act  by  the 
Telecommunications  Act  of  1996.  Telecommunications  Act  of  1996,  P.L.  104-104, 1  lOStat. 
56  (codified  at  47  U.S.C.  §§  151  et  seq.). 
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(A)  information  that  relates  to  the  quantity,  technical  configuration,  type, 
destination,  location,  and  amount  of  use  of  a  telecommunications  service 
subscribed  to  by  any  customer  of  a  telecommunications  carrier,  and  that  is  made 
available  to  the  carrier  by  the  customer  solely  by  virtue  of  the  carrier-customer 
relationship;  and  (B)  information  contained  in  the  bills  pertaining  to  telephone 
exchange  service  or  telephone  toll  service  received  by  a  customer  of  a  carrier.29 

CPNI  includes  customers’  calling  activities  and  history  (e.g.,  phone  numbers  called, 
frequency,  duration,  and  time),  and  billing  records.  It  does  not  include  subscriber  list 
information,  such  as  name,  address,  and  phone  number. 

In  section  222,  Congress  created  a  framework  to  govern  telecommunications 
carriers’  use  of  information  obtained  through  provision  of  a  telecommunications 
service.  Section  222  of  the  Act  provides  that  telecommunications  carriers  must 
protect  the  confidentiality  of  customer  proprietary  network  information.  The  Act 
limits  carriers’  abilities  to  use  customer  phone  records,  including  for  their  own 
marketing  purposes,  without  customer  approval  and  appropriate  safeguards.  The  Act 
also  prohibits  carriers  from  using,  disclosing,  or  permitting  access  to  this  information 
without  the  approval  of  the  customer,  or  as  otherwise  required  by  law,  if  the  use  or 
disclosure  is  not  in  connection  with  the  provided  service. 

Section  222(a)  imposes  a  general  duty  on  telecommunications  carriers  to  protect 
the  confidentiality  of  proprietary  information  of  other  carriers,  equipment 
manufacturers,  and  customers.30  Section  222(b)  states  that  a  carrier  that  receives  or 
obtains  proprietary  information  from  other  carriers  in  order  to  provide  a 
telecommunications  service  may  use  such  information  only  for  that  purpose  and  may 
not  use  that  information  for  its  own  marketing  efforts.31 

The  confidentiality  protections  applicable  to  customer  proprietary  network 
information  are  established  in  section  222(c).  Subsection  (c)(1)  constitutes  the  core 
privacy  requirement  for  telecommunications  carriers. 

Except  as  required  by  law  or  with  the  approval  of  the  customer,  a 
telecommunications  carrier  that  receives  or  obtains  customer  proprietary  network 
information  by  virtue  of  its  provision  of  a  telecommunications  service  shall  only 
use,  disclose,  or  permit  access  to  individually  identifiable  customer  proprietary 
network  information  in  its  provision  of  (A)  the  telecommunications  service  from 
which  such  information  is  derived,  or  (B)  services  necessary  to,  or  used  in,  the 
provision  of  such  telecommunications  service,  including  the  publishing  of 
directories.32 


29  47  U.S.C.  §  222(h)(1). 

30  47  U.S.C.§  222(a). 

31  47  U.S.C.  §  222(b). 

32  47  U.S.C.  §  222(c)(1). 
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Section  222(c)(2)  provides  that  a  carrier  must  disclose  CPNI  “upon  affirmative 
written  request  by  the  customer,  to  any  person  designated  by  the  customer.”33 
Section  222(c)(3)  provides  that  a  carrier  may  use,  disclose,  or  permit  access  to 
aggregate  customer  information  other  than  for  the  purposes  described  in  subsection 
(l).34  Thus,  the  general  principle  of  confidentiality  for  customer  information  is  that 
a  carrier  may  only  use,  disclose,  or  permit  access  to  customers’  individually 
identifiable  CPNI  in  limited  circumstances:  (1)  as  required  by  law;35  (2)  with  the 
customer’s  approval;  or  (3)  in  its  provision  of  the  telecommunications  service  from 
which  such  information  is  derived,  or  services  necessary  to  or  used  in  the  provision 
of  such  telecommunications  service. 

Exceptions  to  the  general  principle  of  confidentiality  permit  carriers  to  use, 
disclose,  or  permit  access  to  customer  proprietary  network  information  to  (1)  initiate, 
render,  bill,  and  collect  for  telecommunications  services;  (2)  protect  the  rights  or 
property  of  the  carrier,  the  customers,  and  other  carriers  from  fraudulent,  abusive,  or 
unlawful  use  of,  or  subscription  to,  such  services;  (3)  provide  any  inbound 
telemarketing,  referral,  or  administrative  services  to  the  customer  for  the  duration  of 
the  call;  and  (4)  provide  call  location  information  concerning  the  user  of  a 
commercial  mobile  service  for  emergency.36 

Section  222(e)  addresses  the  disclosure  of  subscriber  list  information,  and 
permits  carriers  to  provide  subscriber  list  information  to  any  person  upon  request  for 
the  purpose  of  publishing  directories.  The  term  “subscriber  list  information”  means 
any  information  identifying  the  listed  names  of  subscribers  of  a  carrier  and  such 
subscribers’  telephone  numbers,  addresses,  or  primary  advertising  classifications,  or 
any  combination  of  such  listed  names,  numbers,  addresses,  or  classifications;  that  the 
carrier  or  an  affiliate  has  published,  caused  to  be  published,  or  accepted  for 
publication  in  any  directory  format.37 

Customer  Proprietary  Network  Information  (CPNI)  Regulations.  In  1998, 
the  Federal  Communications  Commission  issued  its  CPNI  Order  to  implement 
section  222. 38  The  CPNI  Order  and  subsequent  orders  issued  by  the  Commission 
govern  the  use  and  disclosure  of  customer  proprietary  network  information  by 
telecommunications  carriers.  When  the  FCC  implemented  Section  222, 
telecommunications  carriers  were  required  to  obtain  express  consent  from  their 
customers  (i.e.,  “opt-in  consent”)  before  a  carrier  could  use  customer  phone  records 
to  market  services  outside  of  the  customer’s  relationship  with  the  carrier.  The  United 


33  47  U.S.C.  §  222(c)(2). 

34  47  U.S.C.  §  222(c)(3).  The  term  “aggregate  customer  information”  means  collective  data 
that  relates  to  a  group  or  category  of  services  or  customers,  from  which  individual  customer 
identities  and  characteristics  have  been  removed.  47  U.S.C.  §  222(h)(2). 

35  Whether  the  statutory  provisions  discussed  in  this  report  would  fall  within  this  exception 
is  uncertain. 

36  47  U.S.C.  §  222(d). 

37  47  U.S.C.  §  222(e). 

38  CPNI  Order,  13  FCC  Red  8061. 
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States  Court  of  Appeals  for  the  Tenth  Circuit  struck  down  those  rules,  finding  that 
they  violated  the  First  and  Fifth  Amendments  of  the  Constitution.39 

Current  CPNI  regulations  require  telecommunications  carriers  to  receive  opt-in 
(affirmative)  consent  before  disclosing  CPNI  to  third  parties  or  affiliates  that  do  not 
provide  communications-related  services.40  However,  carriers  are  permitted  to 
disclose  CPNI  to  affiliated  parties  after  obtaining  a  customer’s  “opt-out”  consent.41 
“Opt-Out”  consent  means  that  the  telephone  company  sends  the  customer  a  notice 
saying  it  will  consider  the  customer  to  have  given  approval  to  use  the  customer’s 
information  for  marketing  unless  the  customer  tells  it  not  to  do  so  (usually  within  30 
days.)42  Carriers  are  required,  prior  to  soliciting  the  customer’s  approval,  to  provide 
notice  to  the  customer  of  the  customer’s  right  to  restrict  use,  disclosure,  and  access 
to  the  customer’s  CPNI.43  Carriers  are  also  required  to  establish  safeguards  to  protect 
against  the  unauthorized  disclosure  of  CPNI,  including  requirements  that  carriers 
maintain  records  that  track  access  to  customer  CPNI  records.44  Each  carrier  is  also 
required  to  certify  annually  its  compliance  with  the  CPNI  requirements  and  to  make 
this  certification  publicly  available.45  The  FCC  recently  proposed  $100,000  fines  on 
telephone  companies  with  inadequate  certifications  regarding  compliance  with  FCC 
rules  protecting  customer  information  from  disclosure.46 

Penalties.  Carriers  in  violation  of  the  CPNI  requirements  are  subject  to  a 
variety  of  penalties  under  the  Act.  Under  the  criminal  penalty  provision  in  section 
501  of  the  Act,  47  U.S.C.  §  501,  any  person  who  willfully  and  knowingly  does, 
causes  or  allows  to  be  done,  any  act,  matter,  or  thing  prohibited  by  the  Act  or 
declared  unlawful,  or  who  willfully  and  knowingly  omits  or  fails  to  do  what  is 
required  by  the  Act,  or  who  willfully  or  knowingly  causes  or  allows  such  omission 
or  failure,  shall  be  punished  for  any  such  offense  for  which  no  penalty  (other  than  a 
forfeiture)  is  provided  by  the  Act  by  a  fine  up  to  $10,000,  imprisonment  up  to  one 
year,  or  both,  and  in  the  case  of  a  person  previously  convicted  of  violating  the  Act, 
a  fine  up  to  $10,000,  imprisonment  up  to  two  years,  or  both. 


39  U.S.  West  v.  FCC,  182F.3d  1224  (10lhCir.  1999),  cert,  denied  Competition  Policy  Instit. 
v.  U.S.  West ,  Inc. ,  530  U.S.  1213  (2000). 

40  Except  as  required  by  law,  carriers  may  not  disclose  CPNI  to  third  parties  or  their  own 
affiliates  that  do  not  provide  communications-related  services  unless  the  consumer  has  given 
“opt  in”  consent,  which  is  express  written,  oral,  or  electronic  consent.  47  C.F.R.  §§ 
64.2005(b),  64.2007(b)(3);  64.2008(e);  see  also  47  C.F.R.  §  64.2003(h)  (defining  “opt-in 
approval”). 

41  47  C.F.R.  §§  64.2005(b),  64.2007(b)(1). 

42  FCC  Consumer  Advisory:  Protecting  the  Privacy  of  Your  Telephone  Calling  Records,  at 
[http://www.fcc.gov/cgb/consumerfacts/phoneaboutyou.html], 

43  47  C.F.R.  §§  64.2008. 

44  47  C.F.R.  §§  64.2009. 

45  47  C.F.R.  §§  64.2009(e). 

46  In  the  Matter  of  Cbeyond  Communications,  FFC,  2006  FCC  FEXIS  1902  (April  21, 
2006),  at  [http://www.fcc.gov/eb/Orders/2006/DA-06-916Al.html]. 
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Section  502  of  the  Act,  47  U.S.C.  §  502,  punishes  willful  and  knowing 
violations  of  Federal  Communication  Commission  regulations.  Any  person  who 
willfully  and  knowingly  violates  any  rule,  regulation,  restriction,  or  condition  made 
or  imposed  by  the  Commission  is,  in  addition  to  other  penalties  provided  by  law, 
subject  to  a  maximum  fine  of  $500  for  each  day  on  which  a  violation  occurs.47 

Under  section  503(b)(1)  of  the  Act,  47  U.S.C.  §  503(b)(1),  any  person  who  is 
determined  by  the  Commission  to  have  willfully  or  repeatedly  failed  to  comply  with 
any  provision  of  the  Act  or  any  rule,  regulation,  or  order  issued  by  the  Commission 
shall  be  liable  to  the  United  States  for  a  civil  money  “forfeiture”  penalty.48  Section 
312(f)(1)  of  the  Act,  47  U.S.C.  §  312(f)(1),  defines  “willful”  as  “the  conscious  and 
deliberate  commission  or  omission  of  [any]  act,  irrespective  of  any  intent  to  violate” 
the  law.  “Repeated”  means  that  the  act  was  committed  or  omitted  more  than  once, 
or  lasts  more  than  one  day.  If  the  violator  is  a  common  carrier,  section  503(b) 
authorizes  the  Commission  to  assess  a  forfeiture  penalty  of  up  to  $130,000  for  each 
violation  or  for  each  day  of  a  continuing  violation,  except  that  the  amount  assessed 
for  any  continuing  violation  shall  not  exceed  a  total  of  $1,325,000  for  any  single  act 
or  failure  to  act.49  To  impose  such  a  forfeiture  penalty,  the  Commission  must  issue 
a  notice  of  apparent  liability,  and  the  person  against  whom  the  notice  has  been  issued 
must  have  an  opportunity  to  show,  in  writing,  why  no  such  forfeiture  penalty  should 
be  imposed.  The  Commission  will  then  issue  a  forfeiture  if  it  finds  by  a 
preponderance  of  the  evidence  that  the  person  has  violated  the  Act  or  a  Commission 
rule. 


47  47  U.S.C.  §  502. 

48  47  U.S.C.  §  503(b)(1). 

49  FCC  Forfeiture  Proceedings,  Limits  on  the  amount  of  forfeiture  assessed,  47  C.F.R.  Part 
1.80(b). 


